The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
References
Link | Resource |
---|---|
https://github.com/democritus-project/d8s-math/issues/11 | Exploit Issue Tracking Third Party Advisory |
https://pypi.org/project/d8s-math/ | Product |
https://pypi.org/project/democritus-strings/ | Product |
Configurations
History
No history.
Information
Published : 2022-09-19 16:15
Updated : 2024-02-28 19:29
NVD link : CVE-2022-38883
Mitre link : CVE-2022-38883
CVE.ORG link : CVE-2022-38883
JSON object : View
Products Affected
d8s-math_project
- d8s-math
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type